Skip to content

Introduce linting #373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexanderdibenedetto merged 3 commits into from
Oct 23, 2026
Merged

Introduce linting #373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a03c03
Import what TSKPinningValidator_Private.h uses
Oct 22, 2026
acdbb64
Add SwiftLint, swift-format and clang-format checks
Oct 22, 2026
9a7932c
Apply lint formatting
Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .clang-format
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
---
BasedOnStyle: WebKit
AlignAfterOpenBracket: BlockIndent
AlignConsecutiveAssignments: false
AlignConsecutiveDeclarations: false
AlignConsecutiveMacros: true
AlignEscapedNewlines: Left
AllowAllArgumentsOnNextLine: true
AllowAllParametersOfDeclarationOnNextLine: false
AllowShortBlocksOnASingleLine: false
AllowShortCaseLabelsOnASingleLine: true
AllowShortFunctionsOnASingleLine: Empty
AlwaysBreakBeforeMultilineStrings: true
BinPackArguments: false
BreakBeforeBraces: Attach
BreakBeforeTernaryOperators: true
ColumnLimit: 180
Cpp11BracedListStyle: false
IncludeBlocks: Preserve
IndentWidth: 4
InsertBraces: true
KeepEmptyLinesAtTheStartOfBlocks: true
NamespaceIndentation: None
ObjCBinPackProtocolList: Never
ObjCBlockIndentWidth: 4
ObjCSpaceAfterProperty: true
PointerAlignment: Right
ReflowComments: true
SortIncludes: true
SpaceBeforeAssignmentOperators: true
SpaceBeforeCpp11BracedList: true
SpaceBeforeCtorInitializerColon: true
SpaceBeforeParens: ControlStatements
SpaceBeforeRangeBasedForLoopColon: true
SpaceInEmptyParentheses: false
SpacesInContainerLiterals: false
UseTab: Never

...
13 changes: 13 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,18 @@ env:
DEVELOPER_DIR: /Applications/Xcode_27.0.app/Contents/Developer

jobs:
lint:
name: Lint
runs-on: xcode-27
timeout-minutes: 10
steps:
- uses: actions/checkout@v7
- run: brew install swiftlint clang-format
- run: ./scripts/lint.sh --check

@claude claude Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) Every CI run can go red with no code change once Homebrew ships a newer clang-format or SwiftLint, and that also skips all test jobs. The lint job runs brew install swiftlint clang-format with no version pin, while scripts/lint.sh --check fails on any formatting diff or strict-mode warning. Fix: pin both tools to the versions used for the reformat, e.g. a clang-format@<major> formula or a fixed SwiftLint release binary, and print their versions in the job log. Since test, demo, xcframework and swift-package all have needs: lint, one drift blocks the whole pipeline.

Why this was flagged

The lint job at .github/workflows/ci.yml:26 runs brew install swiftlint clang-format, which installs whatever version Homebrew currently has. scripts/lint.sh:30 runs clang-format --dry-run --Werror and scripts/lint.sh:29 runs swiftlint lint --strict, so the job fails on any output difference or new warning. clang-format output changes between LLVM major releases under the same .clang-format (WebKit base, InsertBraces, AlignAfterOpenBracket: BlockIndent). New SwiftLint releases add default-on rules, and --strict turns their warnings into errors. When Homebrew bumps either formula, lint fails on an unchanged tree. Because the test, demo, xcframework and swift-package jobs now have needs: lint, they are all skipped. On the base branch there is no lint job and these jobs run on every push. The only tool tied to the pinned DEVELOPER_DIR Xcode is xcrun swift format; the brew tools have no such pin.

Verification: The new lint job runs - run: brew install swiftlint clang-format with no version pin. That step is at .github/workflows/ci.yml line 25. scripts/lint.sh, which this diff adds, then fails on any difference. The diff also adds needs: lint to test, demo, xcframework and swift-package, so a lint failure caused only by a tool update skips all test and build jobs.


test:
name: Test ${{ matrix.platform }}
needs: lint
runs-on: xcode-27
timeout-minutes: 30
strategy:
Expand All @@ -39,6 +49,7 @@ jobs:

demo:
name: Demo UI tests ${{ matrix.scheme }}
needs: lint
runs-on: xcode-27
timeout-minutes: 30
strategy:
Expand All @@ -57,6 +68,7 @@ jobs:

xcframework:
name: Build XCFramework
needs: lint
runs-on: xcode-27
timeout-minutes: 30
steps:
Expand All @@ -65,6 +77,7 @@ jobs:

swift-package:
name: Validate Swift package
needs: lint
runs-on: xcode-27
timeout-minutes: 30
steps:
Expand Down
75 changes: 75 additions & 0 deletions .swift-format
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
{
"fileScopedDeclarationPrivacy" : {
"accessLevel" : "private"
},
"indentConditionalCompilationBlocks" : true,
"indentSwitchCaseLabels" : false,
"indentation" : {
"spaces" : 4
},
"lineBreakAroundMultilineExpressionChainComponents" : true,
"lineBreakBeforeControlFlowKeywords" : false,
"lineBreakBeforeEachArgument" : true,
"lineBreakBeforeEachGenericRequirement" : true,
"lineBreakBetweenDeclarationAttributes" : false,
"lineLength" : 120,
"maximumBlankLines" : 1,
"multiElementCollectionTrailingCommas" : false,
"noAssignmentInExpressions" : {
"allowedFunctions" : [
"XCTAssertNoThrow"
]
},
"prioritizeKeepingFunctionOutputTogether" : false,
"reflowMultilineStringLiterals" : "never",
"respectsExistingLineBreaks" : true,
"rules" : {
"AllPublicDeclarationsHaveDocumentation" : false,
"AlwaysUseLiteralForEmptyCollectionInit" : false,
"AlwaysUseLowerCamelCase" : false,
"AmbiguousTrailingClosureOverload" : false,
"AvoidRetroactiveConformances" : true,
"BeginDocumentationCommentWithOneLineSummary" : false,
"DoNotUseSemicolons" : true,
"DontRepeatTypeInStaticProperties" : true,
"FileScopedDeclarationPrivacy" : true,
"FullyIndirectEnum" : true,
"GroupNumericLiterals" : true,
"IdentifiersMustBeASCII" : true,
"NeverForceUnwrap" : false,
"NeverUseForceTry" : true,
"NeverUseImplicitlyUnwrappedOptionals" : false,
"NoAccessLevelOnExtensionDeclaration" : false,
"NoAssignmentInExpressions" : true,
"NoBlockComments" : true,
"NoCasesWithOnlyFallthrough" : true,
"NoEmptyLinesOpeningClosingBraces" : false,
"NoEmptyTrailingClosureParentheses" : true,
"NoLabelsInCasePatterns" : true,
"NoLeadingUnderscores" : false,
"NoParensAroundConditions" : true,
"NoPlaygroundLiterals" : true,
"NoVoidReturnOnFunctionSignature" : true,
"OmitExplicitReturns" : true,
"OneCasePerLine" : true,
"OneVariableDeclarationPerLine" : true,
"OnlyOneTrailingClosureArgument" : true,
"OrderedImports" : true,
"ReplaceForEachWithForLoop" : true,
"ReturnVoidInsteadOfEmptyTuple" : true,
"TypeNamesShouldBeCapitalized" : true,
"UseEarlyExits" : true,
"UseExplicitNilCheckInConditions" : true,
"UseLetInEveryBoundCaseVariable" : true,
"UseShorthandTypeNames" : true,
"UseSingleLinePropertyGetter" : true,
"UseSynthesizedInitializer" : true,
"UseTripleSlashForDocumentationComments" : true,
"UseWhereClausesInForLoops" : true,
"ValidateDocumentationComments" : false
},
"spacesAroundRangeFormationOperators" : false,
"spacesBeforeEndOfLineComments" : 2,
"tabWidth" : 4,
"version" : 1
}
18 changes: 18 additions & 0 deletions .swiftlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
disabled_rules:
- line_length
- file_length
- inclusive_language
- large_tuple
- function_body_length
- type_body_length
- trailing_whitespace # Let swift-format handle whitespace
- vertical_whitespace # Let swift-format handle line breaks
- opening_brace # Let swift-format handle brace placement
- closure_parameter_position # Let swift-format handle closure parameter position

opt_in_rules:
- private_over_fileprivate

excluded:
- output
- .build
9 changes: 4 additions & 5 deletions Package.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,14 @@ let package = Package(
.library(
name: "TrustKit",
targets: ["TrustKit"]
),
],
dependencies: [
)
],
dependencies: [],
targets: [
.target(
name: "TrustKit",
dependencies: ["TrustKitSwift"],
path: "TrustKit",
path: "TrustKit",
exclude: ["Swift"],
resources: [.process("PrivacyInfo.xcprivacy")],
publicHeadersPath: "public",
Expand All @@ -32,6 +31,6 @@ let package = Package(
.target(
name: "TrustKitSwift",
path: "TrustKit/Swift"
),
)
]
)
11 changes: 5 additions & 6 deletions TrustKit/Pinning/TSKPublicKeyAlgorithm.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
/*

TSKPublicKeyAlgorithm.h
TrustKit

Copyright 2015 The TrustKit Project Authors
Licensed under the MIT license, see associated LICENSE file for terms.
See AUTHORS file for the list of project authors.

*/

#ifndef TSKPublicKeyAlgorithm_h
Expand All @@ -19,14 +19,13 @@
#endif

// The internal enum we use for public key algorithms; not to be confused with the exported TSKSupportedAlgorithm
typedef NS_ENUM(NSInteger, TSKPublicKeyAlgorithm)
{
typedef NS_ENUM(NSInteger, TSKPublicKeyAlgorithm) {
// Some assumptions are made about this specific ordering in public_key_utils.m
TSKPublicKeyAlgorithmRsa2048 = 0,
TSKPublicKeyAlgorithmRsa4096 = 1,
TSKPublicKeyAlgorithmEcDsaSecp256r1 = 2,
TSKPublicKeyAlgorithmEcDsaSecp384r1 = 3,

TSKPublicKeyAlgorithmLast = TSKPublicKeyAlgorithmEcDsaSecp384r1
} __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration.");

Expand Down
12 changes: 6 additions & 6 deletions TrustKit/Pinning/TSKSPKIHashCache.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
/*

TSKSPKIHashCache.h
TrustKit

Copyright 2015 The TrustKit Project Authors
Licensed under the MIT license, see associated LICENSE file for terms.
See AUTHORS file for the list of project authors.

*/

#if __has_feature(modules)
Expand All @@ -26,7 +26,7 @@ NS_ASSUME_NONNULL_BEGIN
// The identifier used for the default shared hash cache. Use this identifier
// in the TSKSPKIHashCache constructor to use the shared cache.
// Versioned so that hashes cached by TrustKit 3.x, which rebuilt the SPKI from the key, are not reused.
static NSString * const kTSKSPKISharedHashCacheIdentifier = @"spki-hash-v2.cache";
static NSString *const kTSKSPKISharedHashCacheIdentifier = @"spki-hash-v2.cache";

// Each key is a raw certificate data (for easy lookup) and each value is the certificate's raw SPKI data
typedef NSMutableDictionary<NSData *, NSData *> SPKICacheDictionnary;
Expand All @@ -43,7 +43,7 @@ typedef NSMutableDictionary<NSData *, NSData *> SPKICacheDictionnary;
@param uniqueIdentifier A unique identifier that is stable across app launches/instance creation
@return An initialized hash cache.
*/
- (instancetype _Nullable)initWithIdentifier:(NSString*)uniqueIdentifier NS_DESIGNATED_INITIALIZER;
- (instancetype _Nullable)initWithIdentifier:(NSString *)uniqueIdentifier NS_DESIGNATED_INITIALIZER;

/**
Get a pin cache for the provided certificate. The pins
Expand All @@ -52,7 +52,7 @@ typedef NSMutableDictionary<NSData *, NSData *> SPKICacheDictionnary;
@param certificate The certificate containing the public key that will be hashed
@return The hash of the public key or nil if the hash could not be generated
*/
- (NSData * _Nullable)hashSubjectPublicKeyInfoFromCertificate:(SecCertificateRef)certificate;
- (NSData *_Nullable)hashSubjectPublicKeyInfoFromCertificate:(SecCertificateRef)certificate;

@end

Expand Down
Loading
Loading